Wire up setting to StartRequest, PR comments

deansheather · deansheather · commit d0f8ba00a3cc · 2025-07-28T14:13:42.000+10:00
diff --git a/App/Models/Settings.cs b/App/Models/Settings.cs
@@ -37,7 +37,7 @@ public class CoderConnectSettings : ISettings<CoderConnectSettings>
     /// <summary>
     /// When this is true Coder Connect will not attempt to protect against Tailscale loopback issues.
     /// </summary>
-    public bool DisableTailscaleLoopProtection { get; set; }
+    public bool EnableCorporateVpnSupport { get; set; }
 
     /// <summary>
     /// CoderConnect current settings version. Increment this when the settings schema changes.
@@ -52,20 +52,20 @@ public CoderConnectSettings()
 
         ConnectOnLaunch = false;
 
-        DisableTailscaleLoopProtection = false;
+        EnableCorporateVpnSupport = false;
     }
 
-    public CoderConnectSettings(int? version, bool connectOnLaunch, bool disableTailscaleLoopProtection)
+    public CoderConnectSettings(int? version, bool connectOnLaunch, bool enableCorporateVpnSupport)
     {
         Version = version ?? VERSION;
 
         ConnectOnLaunch = connectOnLaunch;
 
-        DisableTailscaleLoopProtection = disableTailscaleLoopProtection;
+        EnableCorporateVpnSupport = enableCorporateVpnSupport;
     }
 
     public CoderConnectSettings Clone()
     {
-        return new CoderConnectSettings(Version, ConnectOnLaunch, DisableTailscaleLoopProtection);
+        return new CoderConnectSettings(Version, ConnectOnLaunch, EnableCorporateVpnSupport);
     }
 }
diff --git a/App/Services/CredentialManager.cs b/App/Services/CredentialManager.cs
@@ -223,8 +223,9 @@ private async Task<CredentialModel> LoadCredentialsInner(CancellationToken ct)
             };
         }
 
-        // Grab the lock again so we can update the state.
-        using (await _opLock.LockAsync(ct))
+        // Grab the lock again so we can update the state. Don't use the CT
+        // here as it may have already been canceled.
+        using (await _opLock.LockAsync(TimeSpan.FromSeconds(5), CancellationToken.None))
         {
             // Prevent new LoadCredentials calls from returning this task.
             if (_loadCts != null)
@@ -242,11 +243,8 @@ private async Task<CredentialModel> LoadCredentialsInner(CancellationToken ct)
                 if (latestCreds is not null) return latestCreds;
             }
 
-            // If there aren't any latest credentials after a cancellation, we
-            // most likely timed out and should throw.
-            ct.ThrowIfCancellationRequested();
-
             UpdateState(model);
+            ct.ThrowIfCancellationRequested();
             return model;
         }
     }
diff --git a/App/Services/RpcController.cs b/App/Services/RpcController.cs
@@ -158,11 +158,7 @@ public async Task StartVpn(CancellationToken ct = default)
         using var _ = await AcquireOperationLockNowAsync();
         AssertRpcConnected();
 
-        var coderConnectSettings = await _settingsManager.Read();
-        var disableTailscaleLoopProtection = coderConnectSettings.DisableTailscaleLoopProtection;
-        Debug.WriteLine(
-            $"Starting VPN with DisableTailscaleLoopProtection={disableTailscaleLoopProtection}");
-
+        var coderConnectSettings = await _settingsManager.Read(ct);
         var credentials = _credentialManager.GetCachedCredentials();
         if (credentials.State != CredentialState.Valid)
             throw new RpcOperationException(
@@ -182,6 +178,7 @@ public async Task StartVpn(CancellationToken ct = default)
                 {
                     CoderUrl = credentials.CoderUrl?.ToString(),
                     ApiToken = credentials.ApiToken,
+                    TunnelUseSoftNetIsolation = coderConnectSettings.EnableCorporateVpnSupport,
                 },
             }, ct);
         }
diff --git a/App/ViewModels/SettingsViewModel.cs b/App/ViewModels/SettingsViewModel.cs
@@ -34,7 +34,7 @@ public SettingsViewModel(ILogger<SettingsViewModel> logger, ISettingsManager<Cod
         _connectSettings = settingsManager.Read().GetAwaiter().GetResult();
         StartOnLogin = startupManager.IsEnabled();
         ConnectOnLaunch = _connectSettings.ConnectOnLaunch;
-        DisableTailscaleLoopProtection = _connectSettings.DisableTailscaleLoopProtection;
+        DisableTailscaleLoopProtection = _connectSettings.EnableCorporateVpnSupport;
 
         // Various policies can disable the "Start on login" option.
         // We disable the option in the UI if the policy is set.
@@ -53,7 +53,7 @@ partial void OnDisableTailscaleLoopProtectionChanged(bool oldValue, bool newValu
             return;
         try
         {
-            _connectSettings.DisableTailscaleLoopProtection = DisableTailscaleLoopProtection;
+            _connectSettings.EnableCorporateVpnSupport = DisableTailscaleLoopProtection;
             _connectSettingsManager.Write(_connectSettings);
         }
         catch (Exception ex)
diff --git a/App/Views/Pages/SettingsMainPage.xaml b/App/Views/Pages/SettingsMainPage.xaml
@@ -44,9 +44,9 @@
                                        >
                     <ToggleSwitch IsOn="{x:Bind ViewModel.ConnectOnLaunch, Mode=TwoWay}" />
                 </controls:SettingsCard>
-                <controls:SettingsCard Description="This setting controls whether Coder Connect should bypass VPN loop preventation mechanism. Turn this ON only when dealing with a Coder deployment behind a corporate VPN."
-                       Header="Disable corporate VPN loop protection"
-                       HeaderIcon="{ui:FontIcon Glyph=&#xE8AF;}"
+                <controls:SettingsCard Description="This setting loosens some VPN loop protection checks in Coder Connect, allowing traffic to flow to a Coder deployment behind a corporate VPN. We only recommend enabling this option if Coder Connect doesn't work with your Coder deployment behind a corporate VPN."
+                       Header="Enable support for corporate VPNs"
+                       HeaderIcon="{ui:FontIcon Glyph=&#xE705;}"
                        >
                     <ToggleSwitch IsOn="{x:Bind ViewModel.DisableTailscaleLoopProtection, Mode=TwoWay}" />
                 </controls:SettingsCard>
diff --git a/App/Views/SettingsWindow.xaml b/App/Views/SettingsWindow.xaml
@@ -9,8 +9,8 @@
     xmlns:winuiex="using:WinUIEx"
     mc:Ignorable="d"
     Title="Coder Settings"
-    Width="600" Height="450"
-    MinWidth="600" MinHeight="450">
+    Width="600" Height="500"
+    MinWidth="600" MinHeight="500">
 
     <Window.SystemBackdrop>
         <MicaBackdrop/>
diff --git a/App/Views/TrayWindow.xaml.cs b/App/Views/TrayWindow.xaml.cs
@@ -5,11 +5,9 @@
 using Coder.Desktop.App.Views.Pages;
 using CommunityToolkit.Mvvm.Input;
 using Microsoft.UI;
-using Microsoft.UI.Input;
 using Microsoft.UI.Windowing;
 using Microsoft.UI.Xaml;
 using Microsoft.UI.Xaml.Controls;
-using Microsoft.UI.Xaml.Documents;
 using Microsoft.UI.Xaml.Media.Animation;
 using System;
 using System.Collections.Generic;
@@ -19,6 +17,7 @@
 using Windows.Graphics;
 using Windows.System;
 using Windows.UI.Core;
+using Microsoft.UI.Input;
 using WinRT.Interop;
 using WindowActivatedEventArgs = Microsoft.UI.Xaml.WindowActivatedEventArgs;
 
@@ -41,7 +40,6 @@ public sealed partial class TrayWindow : Window
 
     private readonly IRpcController _rpcController;
     private readonly ICredentialManager _credentialManager;
-    private readonly ISyncSessionController _syncSessionController;
     private readonly IUpdateController _updateController;
     private readonly IUserNotifier _userNotifier;
     private readonly TrayWindowLoadingPage _loadingPage;
@@ -51,15 +49,13 @@ public sealed partial class TrayWindow : Window
 
     public TrayWindow(
         IRpcController rpcController, ICredentialManager credentialManager,
-        ISyncSessionController syncSessionController, IUpdateController updateController,
-        IUserNotifier userNotifier,
+        IUpdateController updateController, IUserNotifier userNotifier,
         TrayWindowLoadingPage loadingPage,
         TrayWindowDisconnectedPage disconnectedPage, TrayWindowLoginRequiredPage loginRequiredPage,
         TrayWindowMainPage mainPage)
     {
         _rpcController = rpcController;
         _credentialManager = credentialManager;
-        _syncSessionController = syncSessionController;
         _updateController = updateController;
         _userNotifier = userNotifier;
         _loadingPage = loadingPage;
@@ -74,9 +70,7 @@ public TrayWindow(
 
         _rpcController.StateChanged += RpcController_StateChanged;
         _credentialManager.CredentialsChanged += CredentialManager_CredentialsChanged;
-        _syncSessionController.StateChanged += SyncSessionController_StateChanged;
-        SetPageByState(_rpcController.GetState(), _credentialManager.GetCachedCredentials(),
-            _syncSessionController.GetState());
+        SetPageByState(_rpcController.GetState(), _credentialManager.GetCachedCredentials());
 
         // Setting these directly in the .xaml doesn't seem to work for whatever reason.
         TrayIcon.OpenCommand = Tray_OpenCommand;
@@ -127,8 +121,7 @@ public TrayWindow(
         };
     }
 
-    private void SetPageByState(RpcModel rpcModel, CredentialModel credentialModel,
-        SyncSessionControllerStateModel syncSessionModel)
+    private void SetPageByState(RpcModel rpcModel, CredentialModel credentialModel)
     {
         if (credentialModel.State == CredentialState.Unknown)
         {
@@ -201,18 +194,13 @@ private void MaybeNotifyUser(RpcModel rpcModel)
 
     private void RpcController_StateChanged(object? _, RpcModel model)
     {
-        SetPageByState(model, _credentialManager.GetCachedCredentials(), _syncSessionController.GetState());
+        SetPageByState(model, _credentialManager.GetCachedCredentials());
         MaybeNotifyUser(model);
     }
 
     private void CredentialManager_CredentialsChanged(object? _, CredentialModel model)
     {
-        SetPageByState(_rpcController.GetState(), model, _syncSessionController.GetState());
-    }
-
-    private void SyncSessionController_StateChanged(object? _, SyncSessionControllerStateModel model)
-    {
-        SetPageByState(_rpcController.GetState(), _credentialManager.GetCachedCredentials(), model);
+        SetPageByState(_rpcController.GetState(), model);
     }
 
     // Sadly this is necessary because Window.Content.SizeChanged doesn't
diff --git a/Vpn.Proto/vpn.proto b/Vpn.Proto/vpn.proto
@@ -62,7 +62,7 @@ message ServiceMessage {
 		StartResponse start = 2;
 		StopResponse stop = 3;
 		Status status = 4;                // either in reply to a StatusRequest or broadcasted
-		StartProgress start_progress = 5; // broadcasted during startup
+		StartProgress start_progress = 5; // broadcasted during startup (used exclusively by Windows)
 	}
 }
 
@@ -214,6 +214,7 @@ message NetworkSettingsResponse {
 // StartResponse.
 message StartRequest {
 	int32 tunnel_file_descriptor = 1;
+	bool tunnel_use_soft_net_isolation = 8;
 	string coder_url = 2;
 	string api_token = 3;
 	// Additional HTTP headers added to all requests

Original file line number	Diff line number	Diff line change
`@@ -37,7 +37,7 @@ public class CoderConnectSettings : ISettings<CoderConnectSettings>`
`37`	`37`	`/// <summary>`
`38`	`38`	`/// When this is true Coder Connect will not attempt to protect against Tailscale loopback issues.`
`39`	`39`	`/// </summary>`
`40`		`- public bool DisableTailscaleLoopProtection { get; set; }`
	`40`	`+ public bool EnableCorporateVpnSupport { get; set; }`
`41`	`41`
`42`	`42`	`/// <summary>`
`43`	`43`	`/// CoderConnect current settings version. Increment this when the settings schema changes.`
`@@ -52,20 +52,20 @@ public CoderConnectSettings()`
`52`	`52`
`53`	`53`	`ConnectOnLaunch = false;`
`54`	`54`
`55`		`- DisableTailscaleLoopProtection = false;`
	`55`	`+ EnableCorporateVpnSupport = false;`
`56`	`56`	`}`
`57`	`57`
`58`		`- public CoderConnectSettings(int? version, bool connectOnLaunch, bool disableTailscaleLoopProtection)`
	`58`	`+ public CoderConnectSettings(int? version, bool connectOnLaunch, bool enableCorporateVpnSupport)`
`59`	`59`	`{`
`60`	`60`	`Version = version ?? VERSION;`
`61`	`61`
`62`	`62`	`ConnectOnLaunch = connectOnLaunch;`
`63`	`63`
`64`		`- DisableTailscaleLoopProtection = disableTailscaleLoopProtection;`
	`64`	`+ EnableCorporateVpnSupport = enableCorporateVpnSupport;`
`65`	`65`	`}`
`66`	`66`
`67`	`67`	`public CoderConnectSettings Clone()`
`68`	`68`	`{`
`69`		`- return new CoderConnectSettings(Version, ConnectOnLaunch, DisableTailscaleLoopProtection);`
	`69`	`+ return new CoderConnectSettings(Version, ConnectOnLaunch, EnableCorporateVpnSupport);`
`70`	`70`	`}`
`71`	`71`	`}`
Original file line number	Diff line number	Diff line change
`@@ -223,8 +223,9 @@ private async Task<CredentialModel> LoadCredentialsInner(CancellationToken ct)`
`223`	`223`	`};`
`224`	`224`	`}`
`225`	`225`
`226`		`- // Grab the lock again so we can update the state.`
`227`		`- using (await _opLock.LockAsync(ct))`
	`226`	`+ // Grab the lock again so we can update the state. Don't use the CT`
	`227`	`+ // here as it may have already been canceled.`
	`228`	`+ using (await _opLock.LockAsync(TimeSpan.FromSeconds(5), CancellationToken.None))`
`228`	`229`	`{`
`229`	`230`	`// Prevent new LoadCredentials calls from returning this task.`
`230`	`231`	`if (_loadCts != null)`
`@@ -242,11 +243,8 @@ private async Task<CredentialModel> LoadCredentialsInner(CancellationToken ct)`
`242`	`243`	`if (latestCreds is not null) return latestCreds;`
`243`	`244`	`}`
`244`	`245`
`245`		`- // If there aren't any latest credentials after a cancellation, we`
`246`		`- // most likely timed out and should throw.`
`247`		`- ct.ThrowIfCancellationRequested();`
`248`		`-`
`249`	`246`	`UpdateState(model);`
	`247`	`+ ct.ThrowIfCancellationRequested();`
`250`	`248`	`return model;`
`251`	`249`	`}`
`252`	`250`	`}`
Original file line number	Diff line number	Diff line change
`@@ -44,9 +44,9 @@`
`44`	`44`	`>`
`45`	`45`	`<ToggleSwitch IsOn="{x:Bind ViewModel.ConnectOnLaunch, Mode=TwoWay}" />`
`46`	`46`	`</controls:SettingsCard>`
`47`		`- <controls:SettingsCard Description="This setting controls whether Coder Connect should bypass VPN loop preventation mechanism. Turn this ON only when dealing with a Coder deployment behind a corporate VPN."`
`48`		`- Header="Disable corporate VPN loop protection"`
`49`		`- HeaderIcon="{ui:FontIcon Glyph=}"`
	`47`	`+ <controls:SettingsCard Description="This setting loosens some VPN loop protection checks in Coder Connect, allowing traffic to flow to a Coder deployment behind a corporate VPN. We only recommend enabling this option if Coder Connect doesn't work with your Coder deployment behind a corporate VPN."`
	`48`	`+ Header="Enable support for corporate VPNs"`
	`49`	`+ HeaderIcon="{ui:FontIcon Glyph=}"`
`50`	`50`	`>`
`51`	`51`	`<ToggleSwitch IsOn="{x:Bind ViewModel.DisableTailscaleLoopProtection, Mode=TwoWay}" />`
`52`	`52`	`</controls:SettingsCard>`